Remote Arbitrary Command Execution Vulnerability in rssh rsync-e

Remote Arbitrary Command Execution Vulnerability in rssh rsync-e

Release date:
Updated on:

Affected Systems:
Rssh 2.3.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56708
CVE (CAN) ID: CVE-2012-2251

Rssh is the shell used in combination with OpenSSH. Only scp and sftp are allowed. Now supports rdist, rsync, and cvs.

Rssh 2.3.3-3 does not properly filter the-e option when using rsync, which can cause remote attackers to exploit this vulnerability to execute arbitrary commands.

<* Source: James Clawson

Link: https://bugzilla.redhat.com/show_bug.cgi? Id = 877279
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Rsync-e./script. sh localhost:/tmp -- server ./

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Rssh
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://prdownloads.sourceforge.net/rssh/rssh-2.3.4.tar.gz? Download